VulnSocial

CVE-2026-35592Disclosure(pyload-ng_project / pyload-ng)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows a specially crafted tar archive to write files outside the intended extraction directory. The correct function os.path.commonpath() was added to the codebase in the CVE-2026-32808 fix (commit 5f4f0fa) but was never applied to _safe_extractall(), making this an incomplete fix. This vulnerability is fixed in 0.5.0b3.dev97.

pyload-ng_project CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pyload-ng

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
pyload-ng_project
Products
pyload-ng

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-07: 2Technical Details · 2026-04-07: 204-07
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-35592 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py… https://www.cve.org/CVERecord?id=CVE-2026-35592 ----- Traducción: CVE-2026-35592 pyL… http://infoflow.cloud`

    Post summary

    The tweet shares a succinct vulnerability disclosure for CVE‑2026‑35592 affecting pyLoad, outlining the vulnerable function and affected version, but provides no evidence of exploitation or repair.

    0000033
    67 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-35592 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py… https://www.cve.org/CVERecord?id=CVE-2026-35592

    Post summary

    The passage announces CVE-2026-35592 in pyLoad's _safe_extractall() function, providing limited technical details while lacking any PoC, exploitation evidence, or patch information.

    00000148
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppyload-ng_projectpyload-ng-python-

Explore more

Back to dashboardpyload-ng_project CVEspyload-ng vulnerabilities